platform_system_sepolicy/private/domain.te

# Transition to crash_dump when /system/bin/crash_dump* is executed.
# This occurs when the process crashes.
domain_auto_trans(domain, crash_dump_exec, crash_dump);
allow domain crash_dump:process sigchld;

# Limit ability to ptrace or read sensitive /proc/pid files of processes
# with other UIDs to these whitelisted domains.
neverallow {
  domain
  -vold
  -dumpstate
  -storaged
  -system_server
  userdebug_or_eng(`-perfprofd')
} self:capability sys_ptrace;

# Limit ability to generate hardware unique device ID attestations to priv_apps
neverallow { domain -priv_app } *:keystore_key gen_unique_id;

# Core domains are not permitted to use kernel interfaces which are not
# explicitly labeled.
# TODO(b/65643247): Apply these neverallow rules to all coredomain.
full_treble_only(`
  # /proc
  neverallow {
    coredomain
    -dumpstate
    -platform_app
    -priv_app
    -shell
    -system_app
    -vold
    -vendor_init
  } proc:file no_rw_file_perms;

  # /sys
  neverallow {
    coredomain
    -charger
    -dumpstate
    -healthd
    -init
    -priv_app
    -storaged
    -system_app
    -ueventd
    -vold
    -vendor_init
  } sysfs:file no_rw_file_perms;

  # /dev
  neverallow {
    coredomain
    -fsck
    -init
    -shell
    -ueventd
    -vendor_init
  } device:{ blk_file file } no_rw_file_perms;

  # debugfs
  neverallow {
    coredomain
    -dumpstate
    -init
    -system_server
    -vendor_init
  } debugfs:file no_rw_file_perms;

  # tracefs
  neverallow {
    coredomain
    userdebug_or_eng(`-atrace')
    -dumpstate
    -init
    -perfprofd
    -shell
    -vendor_init
  } debugfs_tracing:file no_rw_file_perms;

  # inotifyfs
  neverallow {
    coredomain
    -init
    -vendor_init
  } inotify:file no_rw_file_perms;

  # pstorefs
  neverallow {
    coredomain
    -bootstat
    -charger
    -dumpstate
    -healthd
    -init
    -logd
    -logpersist
    -recovery_persist
    -recovery_refresh
    -shell
    -system_server
    -vendor_init
  } pstorefs:file no_rw_file_perms;

  # configfs
  neverallow {
    coredomain
    -init
    -system_server
    -vendor_init
  } configfs:file no_rw_file_perms;

  # functionfs
  neverallow {
    coredomain
    -adbd
    -init
    -mediaprovider
    -vendor_init
  }functionfs:file no_rw_file_perms;

  # usbfs and binfmt_miscfs
  neverallow {
    coredomain
    -init
    -vendor_init
  }{ usbfs binfmt_miscfs }:file no_rw_file_perms;
')
Introduce crash_dump debugging helper. Replace the global debuggerd with a per-process debugging helper that gets exec'ed by the process that crashed. Bug: http://b/30705528 Test: crasher/crasher64, `debuggerd <pid>`, `kill -ABRT <pid>` Change-Id: Iad1b7478f7a4e2690720db4b066417d8b66834ed 2016-10-19 23:39:30 +02:00			`# Transition to crash_dump when /system/bin/crash_dump* is executed.`
			`# This occurs when the process crashes.`
			`domain_auto_trans(domain, crash_dump_exec, crash_dump);`
			`allow domain crash_dump:process sigchld;`

sepolicy: add version_policy tool and version non-platform policy. In order to support platform changes without simultaneous updates from non-platform components, the platform and non-platform policies must be split. In order to provide a guarantee that policy written for non-platform objects continues to provide the same access, all types exposed to non-platform policy are versioned by converting them and the policy using them into attributes. This change performs that split, the subsequent versioning and also generates a mapping file to glue the different policy components together. Test: Device boots and runs. Bug: 31369363 Change-Id: Ibfd3eb077bd9b8e2ff3b2e6a0ca87e44d78b1317 2016-10-12 23:58:09 +02:00			`# Limit ability to ptrace or read sensitive /proc/pid files of processes`
			`# with other UIDs to these whitelisted domains.`
			`neverallow {`
			`domain`
			`-vold`
			`-dumpstate`
Storaged permissions for task I/O Allow storaged to read /proc/[pid]/io Grant binder access to storaged Add storaged service Grant storaged_exec access to dumpstate Grant storaged binder_call to dumpstate Bug: 32221677 Change-Id: Iecc9dba266c5566817a99ac6251eb943a0bac630 2016-07-01 21:18:54 +02:00			`-storaged`
sepolicy: add version_policy tool and version non-platform policy. In order to support platform changes without simultaneous updates from non-platform components, the platform and non-platform policies must be split. In order to provide a guarantee that policy written for non-platform objects continues to provide the same access, all types exposed to non-platform policy are versioned by converting them and the policy using them into attributes. This change performs that split, the subsequent versioning and also generates a mapping file to glue the different policy components together. Test: Device boots and runs. Bug: 31369363 Change-Id: Ibfd3eb077bd9b8e2ff3b2e6a0ca87e44d78b1317 2016-10-12 23:58:09 +02:00			`-system_server`
			userdebug_or_eng(`-perfprofd')
			`} self:capability sys_ptrace;`
Add keystore_key:attest_unique_id to priv_app. Only privileged apps are supposed to be able to get unique IDs from attestation. Test: CTS test verifies the negative condition, manual the positive Bug: 34671471 Change-Id: I9ab3f71b1e11ed1d7866ff933feece73152d2578 2017-04-11 17:41:25 +02:00
			`# Limit ability to generate hardware unique device ID attestations to priv_apps`
			`neverallow { domain -priv_app } *:keystore_key gen_unique_id;`
Neverallow coredomain to kernel interface files. Core domains should not be allowed access to kernel interfaces, which are not explicitly labeled. These interfaces include (but are not limited to): 1. /proc 2. /sys 3. /dev 4. debugfs 5. tracefs 6. inotifyfs 7. pstorefs 8. configfs 9. functionfs 10. usbfs 11. binfmt_miscfs We keep a lists of exceptions to the rule, which we will be gradually shrinking. This will help us prevent accidental regressions in our efforts to label kernel interfaces. Bug: 68159582 Bug: 68792382 Test: build aosp_sailfish-user Test: build aosp_sailfish-userdebug Test: CP to internal and build walleye-user Change-Id: I1b2890ce1efb02a08709a6132cf2f12f9d88fde7 2017-11-02 18:08:30 +01:00
			`# Core domains are not permitted to use kernel interfaces which are not`
			`# explicitly labeled.`
			`# TODO(b/65643247): Apply these neverallow rules to all coredomain.`
			full_treble_only(`
			`# /proc`
			`neverallow {`
			`coredomain`
			`-dumpstate`
			`-platform_app`
			`-priv_app`
			`-shell`
			`-system_app`
			`-vold`
			`-vendor_init`
			`} proc:file no_rw_file_perms;`

			`# /sys`
			`neverallow {`
			`coredomain`
			`-charger`
			`-dumpstate`
			`-healthd`
			`-init`
			`-priv_app`
			`-storaged`
			`-system_app`
			`-ueventd`
			`-vold`
			`-vendor_init`
			`} sysfs:file no_rw_file_perms;`

			`# /dev`
			`neverallow {`
			`coredomain`
			`-fsck`
			`-init`
			`-shell`
			`-ueventd`
			`-vendor_init`
			`} device:{ blk_file file } no_rw_file_perms;`

			`# debugfs`
			`neverallow {`
			`coredomain`
			`-dumpstate`
			`-init`
			`-system_server`
			`-vendor_init`
			`} debugfs:file no_rw_file_perms;`

			`# tracefs`
			`neverallow {`
			`coredomain`
			userdebug_or_eng(`-atrace')
			`-dumpstate`
			`-init`
			`-perfprofd`
			`-shell`
			`-vendor_init`
			`} debugfs_tracing:file no_rw_file_perms;`

			`# inotifyfs`
			`neverallow {`
			`coredomain`
			`-init`
			`-vendor_init`
			`} inotify:file no_rw_file_perms;`

			`# pstorefs`
			`neverallow {`
			`coredomain`
			`-bootstat`
			`-charger`
			`-dumpstate`
			`-healthd`
			`-init`
			`-logd`
			`-logpersist`
			`-recovery_persist`
			`-recovery_refresh`
			`-shell`
			`-system_server`
			`-vendor_init`
			`} pstorefs:file no_rw_file_perms;`

			`# configfs`
			`neverallow {`
			`coredomain`
			`-init`
			`-system_server`
			`-vendor_init`
			`} configfs:file no_rw_file_perms;`

			`# functionfs`
			`neverallow {`
			`coredomain`
			`-adbd`
			`-init`
			`-mediaprovider`
			`-vendor_init`
			`}functionfs:file no_rw_file_perms;`

			`# usbfs and binfmt_miscfs`
			`neverallow {`
			`coredomain`
			`-init`
			`-vendor_init`
			`}{ usbfs binfmt_miscfs }:file no_rw_file_perms;`
			`')`